3 ms·

I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed ever

by dudul 9y ago

I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years" G0Fuc4Y@urse!f To me this is a sure way that people are gonna pick horrible and stupid passwords.

raverbashing 9y ago
And leave them in a post-it glued to their monitor
- Xylakant 9y ago
  Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.
majewsky 9y ago
> Your password must be at least 10 character long You forgot "and may not be longer than 16 characters".
- subcosmos 9y ago
  you just know they are storing it in a plaintext VARCHAR(16) column and not hashing it in any way ....
- lithos 9y ago
  HRBlock does this.
- scrooched_moose 9y ago
  Unless they've changed it in the last couple months, TRowe Price still limits passwords to 10 characters. And this is after a recent "We've upgraded our security!" push where I had to reset everything. I've seriously considered closing my accounts over it. Edit: Yep, still as bad Password must be 6-10 characters and contain at least 2 numbers and 2 letters. Password may not contain the following special characters: space , + " % & ' ; = ^ or curly braces.
  - TremendousJudge 9y ago
    my bank's password has to be exactly 8 characters and is case insensitive it's pretty insane considering it's like the most important password I have
    - parliament32 9y ago
      I've got one better: my online banking requires 7 digits exactly, numbers only. This is so you can use the same "password" in their phone banking thingy.
aclarry 9y ago
Even better if it just says "your password does not fit our requirements" :) I was signing up for a bank account and had to make a password for my online account in the branch. Turns out my 16-character randomly generated password made the system unhappy. Tried 6 more times with newly generated passwords (character-only, alphanumeric only, alphanumeric and "#" or "$" only) and it just said the password was not acceptable. So in the end I used my probably ~15 bits of entropy super easy to crack password from when I was 10, with a few randomly generated characters on the end (because more than a few would make the system complain again). The pervasiveness of poor UI and security design baffles me. You would've thought that one of the largest banks in the world would have a little more competency but nope.
toss1 9y ago
exactly -- that and write down those horrible and stupid passwords on sticky-notes and attach them to their monitor bezel or keyboard.

by dudul 9y ago

raverbashing 9y ago

And leave them in a post-it glued to their monitor

Xylakant 9y ago
Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.

majewsky 9y ago

> Your password must be at least 10 character long You forgot "and may not be longer than 16 characters".

subcosmos 9y ago
you just know they are storing it in a plaintext VARCHAR(16) column and not hashing it in any way ....
lithos 9y ago
HRBlock does this.
scrooched_moose 9y ago
Unless they've changed it in the last couple months, TRowe Price still limits passwords to 10 characters. And this is after a recent "We've upgraded our security!" push where I had to reset everything. I've seriously considered closing my accounts over it. Edit: Yep, still as bad Password must be 6-10 characters and contain at least 2 numbers and 2 letters. Password may not contain the following special characters: space , + " % & ' ; = ^ or curly braces.
- TremendousJudge 9y ago
  my bank's password has to be exactly 8 characters and is case insensitive it's pretty insane considering it's like the most important password I have
  - parliament32 9y ago
    I've got one better: my online banking requires 7 digits exactly, numbers only. This is so you can use the same "password" in their phone banking thingy.

aclarry 9y ago

Even better if it just says "your password does not fit our requirements" :) I was signing up for a bank account and had to make a password for my online account in the branch. Turns out my 16-character randomly generated password made the system unhappy. Tried 6 more times with newly generated passwords (character-only, alphanumeric only, alphanumeric and "#" or "$" only) and it just said the password was not acceptable. So in the end I used my probably ~15 bits of entropy super easy to crack password from when I was 10, with a few randomly generated characters on the end (because more than a few would make the system complain again). The pervasiveness of poor UI and security design baffles me. You would've thought that one of the largest banks in the world would have a little more competency but nope.

toss1 9y ago

exactly -- that and write down those horrible and stupid passwords on sticky-notes and attach them to their monitor bezel or keyboard.